CVE-2006-2274: lksctp stream_control_transmission_protocol
Vulnerability summary
CVE-2006-2274 is a medium (CVSS 5.0) vulnerability in lksctp stream_control_transmission_protocol. EPSS estimates a 3.91% chance of exploitation in the next 30 days, higher than 90.2% of scored vulnerabilities.
Not severe (CVSS 5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 3Timeline
- 09-05-2006PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (infinite recursion and crash) via a packet that contains two or more DATA fragments, which causes an skb pointer to refer back to itself when the full message is reassembled, leading to infinite recursion in the sctp_skb_pull function.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
3.91%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
Increase +0.09 pp
From 3.82% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Lksctp1 product
1 vendor · 1 product
References
23 links- support.avaya.com/elmodocs2/security/ASA-2006-161.htmX Refsource CONFIRM
Show all 23 references
- git.kernel.org/gitX Refsource CONFIRM
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9531VDB EntrySignatureX Refsource OVAL